pwned.coffee

coffee.pwned/pwned-coffeeVersion 1.0.0

Live security incidents, updated hourly: fix status, fixed versions, lockfile and repo checks.

Status

Responds555 msNov 14, 2026, 13:44 UTCAnswered our handshake without sign-in.

Registry data may be out of date

We could not refresh it, so this page shows the last copy.

Last checked: Nov 14, 2026, 13:44 UTC
Latency: 555 ms
Remotes responding: 1 of 1
Sign-in: No sign-in
Hosting: Hosted outside the EU (detected)
Registry data as of: Nov 14, 2026, 22:14 UTC

Data from the official MCP Registry, checked by run.zero. How we check

Connect

Streamable HTTP

https://pwned.coffee/mcpResponds555 msNov 14, 2026, 13:44 UTC

No sign-in

Claude Code

claude mcp add --transport http pwned-coffee https://pwned.coffee/mcp

Claude Desktop and claude.ai

1
2
3

Settings > Connectors > Add custom connector
Name: pwned-coffee
Remote MCP server URL: https://pwned.coffee/mcp

Cursor

{
  "mcpServers": {
    "pwned-coffee": {
      "url": "https://pwned.coffee/mcp"
    }
  }
}

VS Code

code --add-mcp '{"name":"pwned-coffee","type":"http","url":"https://pwned.coffee/mcp"}'

Built your own server? run.zero hosts MCP servers on European infrastructure.

Host your own MCP server on run.zero

Tools

6 tools

Tools of pwned.coffee
	Description		Read-only	Idempotent	Open world
`check_lockfile`Match the packages and versions in a lockfile against incidents that state fixed versions, and print a receipt: what you use, the version, affected or not, and the exact upgrade. Accepts package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, poetry.lock, uv.lock, Pipfile.lock, composer.lock, go.sum, go.mod, Cargo.lock, Gemfile.lock, a Dockerfile, an .nvmrc / .node-version ("node") or a GitHub Actions workflow ("actions"). For several files at once, use check_repo.	Match the packages and versions in a lockfile against incidents that state fixed versions, and print a receipt: what you use, the version, affected or not, and the exact upgrade. Accepts package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, poetry.lock, uv.lock, Pipfile.lock, composer.lock, go.sum, go.mod, Cargo.lock, Gemfile.lock, a Dockerfile, an .nvmrc / .node-version ("node") or a GitHub Actions workflow ("actions"). For several files at once, use check_repo.	Not declared	Yes	Not declared	No
`check_repo`Send the files that describe what a project runs (lockfiles, Dockerfiles, .github/workflows/.yml, wrangler.toml, vercel.json, next.config., compose files) in one call. Returns one receipt: every affected package with the exact command to fix it in the tool the repo already uses, actions and images to check, and live incidents for the detected stack that the files cannot rule out.	Send the files that describe what a project runs (lockfiles, Dockerfiles, .github/workflows/.yml, wrangler.toml, vercel.json, next.config., compose files) in one call. Returns one receipt: every affected package with the exact command to fix it in the tool the repo already uses, actions and images to check, and live incidents for the detected stack that the files cannot rule out.	Not declared	Yes	Not declared	No
`diff_since`Every correction, new ticket and fix-status change since a point in time, each with the source behind it (the same log as /corrections). Use it to audit what the board changed since your last run. Accepts an ISO 8601 timestamp, or "24h", "7d", "90m".	Every correction, new ticket and fix-status change since a point in time, each with the source behind it (the same log as /corrections). Use it to audit what the board changed since your last run. Accepts an ISO 8601 timestamp, or "24h", "7d", "90m".	Not declared	Yes	Not declared	No
`lookup_cve`The incident covering a CVE or GHSA id, or a named bug (e.g. HTTP2Shell): summary, severity, patch status, fixed versions, timeline and sources.	The incident covering a CVE or GHSA id, or a named bug (e.g. HTTP2Shell): summary, severity, patch status, fixed versions, timeline and sources.	Not declared	Yes	Not declared	No
`todays_specials`Live security incidents right now (CVEs, breaches, supply-chain compromises) with severity, patch status, fixed versions and ids. Pass stack ids to see only what touches your stack. Known ids: nextjs, react, node, bun, php, python, ruby, go, java, wordpress, drupal, magento, perl, proof-tools, dotnet, rust, npm, pypi, github-actions, docker, vscode, browser-ext, linux, linux-services, openssh, nginx, apache, kubernetes, postgres, mysql, redis, gitlab, ci, atlassian, self-hosted, selfhost-apps, paas, cloudflare, aws, gcp, azure, vps, databases-cloud, ai-gateways, ai-keys, ml-infra, mcp, chrome, apple, android, windows, office, office-suites, password-managers, messaging, crypto-wallets, vpn-edge, ics, remote-support, vmware, security-tools, health-it, erp.	Live security incidents right now (CVEs, breaches, supply-chain compromises) with severity, patch status, fixed versions and ids. Pass stack ids to see only what touches your stack. Known ids: nextjs, react, node, bun, php, python, ruby, go, java, wordpress, drupal, magento, perl, proof-tools, dotnet, rust, npm, pypi, github-actions, docker, vscode, browser-ext, linux, linux-services, openssh, nginx, apache, kubernetes, postgres, mysql, redis, gitlab, ci, atlassian, self-hosted, selfhost-apps, paas, cloudflare, aws, gcp, azure, vps, databases-cloud, ai-gateways, ai-keys, ml-infra, mcp, chrome, apple, android, windows, office, office-suites, password-managers, messaging, crypto-wallets, vpn-edge, ics, remote-support, vmware, security-tools, health-it, erp.	Not declared	Yes	Not declared	No
`whats_new`Incidents created or updated since a point in time, newest first. Use it to re-check only what changed since your last run. Accepts "24h", "7d", "90m" or an ISO timestamp.	Incidents created or updated since a point in time, newest first. Use it to re-check only what changed since your last run. Accepts "24h", "7d", "90m" or an ISO timestamp.	Not declared	Yes	Not declared	No

Details

Registry status: Active
Published: Nov 2, 2026
Updated: Nov 2, 2026
Website: https://pwned.coffee/mcp⁠ (opens in a new tab)
Repository: Not given
Categories (suggested): SecuritySuggested categories are assigned automatically from the registry text and may be wrong. Verified operators can correct them.
GDPR: Not declared

Are you the operator? Claim this listing